43-6
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 43 Configuring Port Security
About Port Security
The sticky secure MAC addresses do not automatically become part of the configuration file, which is
the startup configuration used each time the switch restarts. If you save the running config file to the
configuration file, the interface does not need to relearn these addresses when the switch restarts. If you
do not save the configuration, they are lost.
If sticky port security is disabled, the sticky secure MAC addresses are converted to dynamic secure
addresses and are removed from the running configuration.
After the maximum number of secure MAC addresses is configured, they are stored in an address table.
To ensure that an attached device has sole access of the port, configure the MAC address of th e atta ched
device and set the maximum number of addresses to one, which is the default.
A security violation occurs if the maximum number of secure MAC addresses to a port has been added
to the address table and a workstation whose MAC address is not in the address table attempts to access
the interface.
Violation Actions
A security violation is triggered when the number of secure MAC addresses on the port exceeds the
maximum number of secure MAC addresses allowed on the port.
Note A secure violation is not triggered if the host secured on one port shows up on another port. The Catalyst
4500 series switch drops such packets on the new port silently in the hardware and does not overload the
CPU.
You can configure the interface for one of following violation modes, which are based on the response
to the violation:
• Restrict—A port security violation restricts data (that is, packets are dropped in software), causes
the SecurityViolation counter to increment, and causes an SNMP Notification to be generated. You
might want to configure this mode in order to provide uninterrupted service/access on a secure port.
The rate at which SNMP traps are generated can be controlled by the
snmp-server enable traps port-security trap-rate command. The default value (“0”) causes an
SNMP trap to be generated for every security violation.
• Shutdown—A port security violation causes the interface to shut down immediately. Y ou might w ant
to configure this mode in a highly secure environment, where you do not want unsecured MAC
addresses to be denied in software and service interruption is not an issue.
• Shutdown VLAN—Use to set the security violation mode for each VLAN. In this mode, the
offending VLAN is error disabled instead of the entire port when a violation occurs.
When a secure port is in the error-disabled state, you can bring it out of this state automatically by
configuring the errdisable recovery cause psecure-violation global configuration command or you
can manually reenable it by entering the shutdown and no shut down interface configuration
commands. it is the default mode. If a port is in per-VLAN errdisable mode, you can also use clear
errdisable interface name vlan range command to reenable the VLAN on the port.
You can also customize the time to recover from the specified error disable cause (default is 300
seconds) by entering the errdisable recovery interval interval command.